RFI Hawk

Trust Center

Operated by Salian Defense
Last updated 2026-09-02

RFI Hawk is built by a defense-industry team for defense and federal contractors. This page states what is actually in place today, what is not, and what is on the roadmap. It is written to be checked, not to impress. We do not publish low-level implementation details, software bills of materials, or named vendor relationships in public; detailed documentation is shared with prospects and customers under NDA on request.

What you may upload and what you must not

RFI Hawk is a commercial cloud service. Do not upload classified information, ITAR or EAR export-controlled technical data. RFI Hawk has not been independently assessed or authorized for Controlled Unclassified Information (CUI). Proprietary company information and Federal Contract Information (FCI) are within scope of our published security controls. You remain responsible for determining the classification of what you upload.

The same rule appears beside every file upload control in the product, and section 5.4 of the Terms of Service makes it a condition of use.

Encryption

• In transit. All connections between your browser and the application use TLS. HTTP Strict Transport Security is enforced in production with the preload directive.
• Field-level encryption at rest. Two classes of sensitive field are encrypted by the application with AES-256-GCM authenticated encryption before they are written to the database: two-factor authentication secrets and CUI scoping answers entered in the CMMC suite. Each value uses a randomly generated nonce and a versioned ciphertext format so the algorithm can be rotated later. The encryption key is held outside the database and can be rotated with tooling.
• What is not field-encrypted. Uploaded documents, proposal drafts, and company profiles are not encrypted by the application itself. They rely on the hosting provider's storage encryption rather than application-level encryption.

Tenant isolation

Customer data is logically isolated. Every request for a user-owned resource (a document, a proposal, a company profile, a saved search) is checked against the requester's ownership before it is returned, so one account cannot read or modify another account's data by guessing identifiers. This is object-level access control, sometimes called IDOR protection. It is not per-tenant databases or per-tenant infrastructure: all customers share one application and one database, and uploaded files are stored in per-user folders.

Authentication and access

• Passwords are stored as one-way salted hashes; we cannot read or recover them.
• Two-factor authentication with standards-based authenticator apps (TOTP) is available on every account. It is optional; we do not force it on today.
• Sign in with Google or Microsoft, with Apple where enabled. Enterprise single sign-on is available on Enterprise agreements.
• Sign-in protection. Repeated failed sign-in attempts lock the account and source network for a cooling-off period, and every attempt is logged.
• Sessions expire after eight hours, and each plan carries a concurrent session limit (older sessions are closed when the limit is reached).
• Administrative access is limited to named staff accounts, and administrative actions are written to the security event log.
• Request protection. Cross-site request forgery (CSRF) tokens are required on every state-changing request, and a content security policy and related headers are sent on every response.

AI processing

• Who processes your text. Proposal drafting, analysis, and compliance checking send the relevant text to commercial large-language-model providers over their APIs. We do not name the providers publicly; the current list is available on request to security@saliandefense.com.
• No training on your content. Our providers' API terms prohibit using customer inputs or outputs to train their models. RFI Hawk never trains models on customer content.
• Provider retention. Provider retention for abuse monitoring is limited and disclosed on request.
• Free and anonymous requests. Free-tier accounts and the anonymous public demo are routed to a separate provider class from paid accounts.
• What is sent. Opportunity text, the prompts you write, and the proposal content being drafted or revised. Passwords, payment details, and your account email are not sent to AI providers.

Data retention and deletion

• Active accounts. Your data is kept for the life of the account.
• Cancelled accounts. Account data is retained for 30 days after cancellation so the account can be reactivated. After that, deletion is carried out on request through our documented deletion process (contact support@rfihawk.io): sessions are ended, the user record is anonymized, and proposals and documents are purged after the retention period, subject to legal and tax retention requirements. Post-cancellation purging is not yet automated.
• Token usage logs are kept for 12 months for billing and audit purposes.
• Consent records (email and SMS consent) are retained and never deleted, as required for TCPA and CAN-SPAM compliance.
• No per-account retention controls today. Retention windows for archived data are set platform-wide by RFI Hawk administrators. Per-account retention settings are a roadmap item.

Backups

Backups are taken by the operator; automated backup verification is an open POA&M item. Our contingency plan sets a 24-hour recovery point objective and a 4-hour recovery time objective as targets. A full recovery drill has not yet been recorded, so treat those figures as targets rather than demonstrated results.

Logging and monitoring

• Security event log. Authentication events, administrative actions, and access-control violations are recorded with severity, category, source IP, and user agent, and are reviewed by our team through an administrative viewer.
• Application logs are kept on rotating files and reviewed by our team.
• No SIEM today. Security events are stored locally; forwarding to a SIEM with automated alerting is an open POA&M item.

Dependencies

Third-party packages are version-pinned. Known vulnerabilities are surfaced two ways: automated dependency alerts from our source code host, and a vulnerability audit that runs in continuous integration on every change. Fixes are floored in the pinned requirements as they ship.

Payments

All payment processing is performed by Stripe, a PCI DSS Level 1 service provider. Card numbers are entered directly with Stripe and never touch RFI Hawk infrastructure; we store only the processor-issued customer identifier and subscription status.

Hosting

The application and database run on US-based cloud infrastructure provided by a commercial hosting platform. It is not a government cloud, and it does not carry a FedRAMP authorization.

Compliance posture

What we do not hold. RFI Hawk does not hold a FedRAMP authorization, a SOC 2 attestation, or an ISO 27001 certification, and we do not claim any certification we have not earned. RFI Hawk does not hold a FedRAMP authorization. FedRAMP is a post-GA roadmap item.

NIST SP 800-53. We map our controls against the NIST SP 800-53 Rev. 5 Moderate baseline. That mapping is offered as alignment, not authorization, and it is not a claim of authorization. The following control families have controls implemented today with supporting evidence:

• Access Control (AC). Authentication required on all non-public routes, role- and tier-based feature gating, object-level ownership checks, and rate-limited sign-in with failed-attempt logging.
• Audit and Accountability (AU). Security event logging with severity, category, source IP, and user agent for authentication, administrative, and access-violation events, with admin review.
• Identification and Authentication (IA). Salted one-way password hashing, optional TOTP two-factor authentication with secrets encrypted at rest, and sign-in through established identity providers.
• System and Communications Protection (SC). TLS in transit with HSTS, AES-256-GCM field-level encryption of the listed fields, and content security policy plus framing and content-type protection headers.
• System and Information Integrity (SI). Parameterized queries, hardened error pages with no stack-trace disclosure, and pinned, vulnerability-audited dependencies.

Other families (for example Configuration Management, Contingency Planning, and Incident Response) are partially implemented or documented with open items. The control-by-control register and the plan of action and milestones are maintained internally and shared with qualified prospects and customers under NDA.

NIST SP 800-171 and CMMC. The CMMC suite inside the product is built around the NIST SP 800-171 requirement set so that customers can track their own controls, and its own controls follow that requirement set. That alignment describes the product's content. It is not an independent assessment of RFI Hawk against NIST SP 800-171, RFI Hawk is not a C3PAO, and RFI Hawk has not been assessed or authorized for CUI.

Roadmap. Pursuing a FedRAMP authorization on a U.S. government cloud, where the underlying cryptographic modules are FIPS 140-2 validated, is a planned milestone after general availability. It is not a status we hold today, and nothing on this page should be read as FIPS validation of the current environment.

Subprocessors

We rely on a small set of service providers, in these categories:

• Cloud hosting for the application and database (US-based)
• Large-language-model API providers for drafting, analysis, and compliance checking
• Payment processing (Stripe)
• Transactional email delivery
• DNS and bot protection on sign-in forms
• Identity providers for social sign-in (Google, Microsoft, Apple where enabled)
• Application error monitoring, when enabled, using the provider SDK default of not sending personally identifiable information; error reports carry request metadata and stack traces
• Public government data sources that receive search queries only, never customer data

A current named list is available on request to security@saliandefense.com. We do not use advertising networks, tracking pixels, or data brokers.

Incident response

We maintain a written incident response plan covering severity classification, containment, eradication, recovery, and post-incident review. Customers whose data is affected by a confirmed incident are notified without undue delay, and within 72 hours of confirmation, with what happened, what data was affected, what we have done, and what they should do. Regulatory notifications are made where the law requires them.

Last updated 2026-09-02. Operated by Salian Defense. Questions: security@saliandefense.com.